Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 75% confidence
- Finding
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
- Content
Security audit
Bytesagain Education
Security checks for vulnerabilities and agentic risk
Overview
This skill is a local education helper that generates study plans and quizzes and stores only simple progress data on the user's machine.
Before installing, understand that the skill stores study progress locally and that reset or set-topic can clear that progress without a confirmation prompt. The Docker commands shown are learning examples, not commands the skill runs automatically.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 75% confidence
- Finding
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 75% confidence
- Finding
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The 'progress reset' command irreversibly overwrites stored user progress without any confirmation prompt, making accidental data loss possible. In this educational-skill context the affected data is low sensitivity, so the issue is more of a safety/integrity weakness than a severe security flaw, but it is still a real destructive action lacking guardrails.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documented progress commands list only show, done, and reset, but the code also implements
progress set-topic, which changes persisted state in the progress file. This is an intent/documentation divergence because the inline usage documentation presents a narrower command surface than what the script actually supports.- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This code creates a storage directory under the user's home folder and writes progress data to ~/.local/share/education-skill/progress.json. While the script exposes progress commands, it does not clearly warn at the point of use or in its usage text that invoking progress actions will persist and overwrite local data.
- Content
Static analysis
No suspicious patterns detected.